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CLAIMS 

What is claimed is: 

5 1 . A data storage system for accessing a set of data, comprising: 

a data access manager for establishing a plurality of tokens for accessing 
the set of data; 

a network connection in communication with the data access manager; and 
a data storage assembly in communication with the network connection, 
10 the data storage assembly comprising (i) a set of storage locations that stores the 

set of data, and (ii) a control circuit configured to: 

receive from a host in communication with the data access 
manager over the network connection (i) a request to access the set of data 
and (ii) a first access token of the plurality of tokens that provides access 
1 5 to the set of data stored in the set of storage locations in the data storage 

system; 

generate an authorization signal that controls access to the set of 
data based on the first access token and a second access token of the 
plurality of tokens, the second access token associated with the set of 
20 storage locations; and 

produce a response signal that provides a response to the request 
over the network connection to the host based on the authorization signal. 
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The data storage system of claim 1, wherein the control circuit is configured to: 

perform a comparison of the first access token to the second access token 
associated with the set of storage locations; and 

if the comparison indicates that the first access token and the 
second access token are identical, produce an access approval signal that 
provides access to the set of storage locations; and 

if the comparison indicates that the first access token and the 
second access token are not identical, produce an access failure signal that 
indicates a denial of access to the set of storage locations. 

The data storage system of claim 1 , wherein the data access manager comprises a 
processor and a memory that stores a data access manager application, wherein 
the processor operates in accordance with instructions of the data access manager 
application stored in the memory to establish the plurality of tokens for accessing 
the set of data, and wherein the instructions of the data access manager application 
configure the processor to: 

associate, prior to receiving the first access token, the second access token 
with the set of storage locations in response to an initial request from the host to 
store the set of data; 

allocate the set of storage locations in the data storage assembly to receive 
the set of data in response to the request to store the set of data, while tagging 
each storage location with the second access token; and 

provide to the host the set of storage locations and the first access token 
based on the second access token. 
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The data storage system of claim 3, wherein the data access manager application 
comprises further instructions that configure the processor to: 

generate, prior to associating the second access token with the set of 
storage locations, an initial access token of the plurality of tokens in response to 
the initial request to store the set of data in the data storage system; 

provide a first copy of the initial access token as the first access token to 
the host over the network connection; and 

provide a second copy of the initial access token as the second access 
token to the data storage assembly. 

The data storage system of claim 1, wherein the request is one of a read request to 
read data from at least one of the set of storage locations and a write request to 
write data to at least one of the set of storage locations. 

The data storage system of claim 1, wherein the network connection is a local area 
network such that the data storage system forms a storage area network. 

In a data storage system having a set of storage locations, a method for accessing a 
set of data stored in the set of storage locations, comprising the steps of: 

receiving from a host (i) a request to access the set of data stored in the set 
of storage locations and (ii) a first access token that provides access to the set of 
data stored in the set of storage locations; 

generating an authorization signal that controls access to the set of data 
based on the first access token and a second access token associated with the set 
of storage locations; and 

producing a response signal that provides a response to the request to the 
host based on the authorization signal 
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8. The method of claim 7, wherein the step of generating an authorization signal 
comprises: 

comparing the first access token to the second access token associated 
with the set of storage locations; and 

if the comparing step indicates that the first access token and the 
second access token are identical, producing an access approval signal that 
provides access to the set of storage locations; and 

if the comparing step indicates that the first access token and the 
second access token are not identical, producing an access failure signal 
that indicates a denial of access to the set of storage locations. 

9. The method of claim 7, further comprising the steps of; 
prior to the step of receiving the first access token, associating the second 

access token with the set of storage locations in response to an initial request from 
1 5 the host to store the set of data; 

allocating the set of storage locations in the data storage assembly to 
receive the set of data in response to the initial request to store the set of data, 
while tagging each storage location with the second access token; and 

providing to the host the set of storage locations and the first access token 
20 based on the second access token. 
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1 0. The method of claim 9, further comprising the steps of: 

prior to the step of associating the second access token with the set of 
storage locations, generating an initial access token in response to the initial 
request to store the set of data in the data storage system; and 
5 providing a first copy of the initial access token as the first access token to 

the host that initiates the request; and 

providing a second copy of the initial access token as the second access 

token. 

10 11. The method of claim 7, wherein the step of receiving the first access token and the 
request comprises receiving one of a read request to read data from at least one of 
the set of storage locations and a write request to write data to at least one of the 
set of storage locations. 



15 12. 



The method of claim 7, wherein the data storage system is a storage area network 
comprising a data access manager and at least one data storage assembly 
comprising storage devices. 
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A computer program product that includes a computer readable medium having 
instructions stored thereon for accessing a set of data, such that the instructions, 
when carried out by a data storage system having a set of storage locations storing 
the set of data, cause the data storage system to perform the steps of: 

receiving from a host (i) a request to access the set of data stored in the set 
of storage locations and (ii) a first access token that provides access to the set of 
data stored in the set of storage locations; 

generating an authorization signal that controls access to the set of data 
based on the first access token and a second access token associated with the set 
of storage locations; and 

produce a response signal that provides a response to the request to the 
host based on the authorization signal. 

A data storage assembly for accessing a set of data, comprising: 
a set of storage locations that stores the set of data; and 
a control circuit in communication with the set of storage locations, the 
control circuit configured to: 

receive from a host in communication with the control circuit over 
a network connection (i) a request to access the set of data and (ii) a first 
access token that provides access to the set of data stored in the set of 
storage locations; 

generate an authorization signal that controls access to the set of 
data based on the first access token and a second access token associated 
with the set of storage locations; and 

produce a response signal that provides a response to the request 
over the network connection to the host based on the authorization signal. 
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15. The data storage assembly of claim 14, wherein the control circuit is configured 
to: 

perform a comparison of the first access token to the second access token 
associated with the set of storage locations; and 
5 if the comparison indicates that the first access token and the 

second access token are identical, produce an access approval signal that 
provides access to the set of storage locations; and 

if the comparison indicates that the first access token and the 
second access token are not identical, produce an access failure signal that 
10 indicates a denial of access to the set of storage locations. 

16. The data storage assembly of claim 14, wherein the request is one of a read 
request to read data from at least one of the set of storage locations and a write 
request to write data to at least one of the set of storage locations. 

15 

17. In a data storage assembly having a set of storage locations, a method for 
accessing a set of data stored in the set of storage locations, comprising the steps 
of: 

receiving from a host (i) a request to access the set of data stored in the set 
20 of storage locations and (ii) a first access token that provides access to the set of 

data stored in the set of storage locations; 

generating an authorization signal that controls access to the set of data 
based on the first access token and a second access token associated with the set 
of storage locations; and 
25 producing a response signal that provides a response to the request to the 

host based on the authorization signal. 
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1 8. The method of claim 17, wherein the step of generating an authorization signal 
comprises: 

comparing the first access token to the second access token associated 
with the set of storage locations; and 
5 if the comparing step indicates that the first access token and the 

second access token are identical, producing an access approval signal that 
provides access to the set of storage locations; and 

if the comparing step indicates that the first access token and the 
second access token are not identical, producing an access failure signal 
1 0 that indicates a denial of access to the set of storage locations. 



19. The method of claim 17, wherein the step of receiving the first access token and 

the request comprises receiving one of a read request to read data from at least one 
of the set of storage locations and a write request to write data to at least one of 
1 5 the set of storage locations. 
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20. A computer program product that includes a computer readable medium having 
instructions stored thereon for accessing a set of data, such that the instructions, 
when carried out by a data storage assembly having a set of storage locations that 
store the set of data, cause the data storage assembly to perform the steps of: 
5 receiving from a host (i) a request to access the set of data stored in the set 

of storage locations and (ii) a first access token that provides access to the set of 
data stored in the set of storage locations; 

generating an authorization signal that controls access to the set of data 
based on the first access token and a second access token associated with the set 
1 0 of storage locations; and 

producing a response signal that provides a response to the request to the 
host based on the authorization signal. 
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21. A host for requesting access to a set of data stored in a set of storage locations in a 
data storage system, comprising: 

a memory comprising a host application; 
an input/output controller; and 
5 a processor in communication with the memory and the input/output 

controller, wherein the processor operates in accordance with instructions of the 
host application stored in the memory to request access to the set of data, and the 
instructions of the host application configure the processor to: 

generate a request to access the set of data stored in the set of 
1 0 storage locations; 

provide through the input/output controller to the data storage 
system the request to access the set of data and a first access token that 
provides access to the set of data; and 

obtain through the input/output controller from the data storage 
1 5 system a response signal that provides a response to the request based on 

the first access token and a second access token associated with each 
storage location. 



22. 

20 



The host of claim 21, wherein the request is one of a read request to read data 
from at least one of the set of storage locations and a write request to write data to 
at least one of the set of storage locations. 
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23. In a host, a method for requesting access to a set of data stored in a set of storage 
locations in a data storage system, comprising the steps of: 

generating a request to access the set of data stored in the set of storage 
locations; 

5 providing the request to access the set of data and a first access token that 

provides access to the set of storage locations; and 

obtaining a response signal that provides a response to the request based 
on the first access token and a second access token associated with each storage 
location. 

10 

24. The method of claim 23, wherein the step of providing the first access token and 
the request comprises providing one of a read request to read data from at least 
one of the set of storage locations and a write request to write data to at least one 
of the set of storage locations, 

15 

25. A computer program product that includes a computer readable medium having 
instructions stored thereon for requesting access to a set of data stored in a set of 
storage locations in a data storage system, such that the instructions, when carried 
out by a computer, cause the computer to perform the steps of: 

20 generating a request to access the set of data stored in the set of storage 

locations; 

providing the request to access the set of data and a first access token that 
provides access to the set of storage locations; and 

obtaining a response signal that provides a response to the request based 
25 on the first access token and a second access token associated with each storage 

location. 



A data access system for providing access to a set of data, comprising: 

a host comprising (i) a memory having a host application, (ii) an 
input/output controller, and (iii) a processor in communication with the memory 
and the input/output controller, wherein the processor operates in accordance with 
instructions of the host application stored in the memory to request access to the 
set of data; 

a network connection in communication with the host; and 
a data storage assembly in communication with the network connection, 
the data storage assembly comprising (i) a set of storage locations that stores the 
set of data, and (ii) a control circuit, wherein: 

the processor of the host operates in accordance with the host 
application to provide to the data storage assembly through the 
input/output controller of the host and the network connection (i) a request 
to access the set of data and (ii) a first access token of a plurality of tokens 
that provides access to the set of data stored in the set of storage locations 
in the data storage assembly; 

the control circuit of the data storage assembly is configured to 
receive over the network connection (i) the request to access the set of data 
and (ii) the first access token provided by the host; 

the control circuit is configured to generate, in response to 
receiving the request and the first access token, an authorization signal that 
controls access to the set of data based on the first access token and a 
second access token of the plurality of tokens, the second access token 
associated with the set of storage locations; and 

the control circuit is configured to produce a response signal that 
provides a response to the request over the network connection to the host 
based on the authorization signal 
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27. The data access system of claim 1 , further comprising a data access manager in 

communication with the network connection, the data access manager comprising 
a processor and a memory that stores a data access manager application, wherein 
the processor operates in accordance with instructions of the data access manager 
5 application stored in the memory to establish the plurality of tokens for accessing 

the set of data, and wherein the instructions of the data access manager application 
configure the processor to: 

associate, prior to receiving the first access token, the second access token 
with the set of storage locations in response to an initial request from the host to 
1 0 store the set of data; 

allocate the set of storage locations in the data storage assembly to receive 
the set of data in response to the initial request to store the set of data, while 
tagging each storage location with the second access token; and 

provide to the host the set of storage locations and the first access token 
1 5 based on the second access token. 
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In a data access system having a host and a data storage assembly having a set of 
storage locations, a method for providing access to a set of data stored in the set of 
storage locations, comprising the steps of: 

providing to the data storage assembly from the host (i) a request to access 
the set of data and (ii) a first access token of a plurality of tokens that provides 
access to the set of data stored in the set of storage locations in the data storage 
assembly; 

generating, in response to receiving the request and the first access token, 
an authorization signal that controls access to the set of data based on the first 
access token and a second access token of the plurality of tokens, the second 
access token associated with the set of storage locations; and 

producing a response signal that provides a response to the request from 
the data storage assembly to the host based on the authorization signal. 

The method of claim 1, wherein the data access system further comprises a data 
access manager, and the method further comprises the steps of; 

associating, prior to receiving the first access token, the second access 
token with the set of storage locations in response to an initial request from the 
host to the data access manager to store the set of data; 

allocating the set of storage locations in the data storage assembly to 
receive the set of data in response to the initial request to store the set of data, 
while tagging each storage location with the second access token; and 

providing to the host from the data access manager the set of storage 
locations and the first access token based on the second access token. 



